CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
user3708270
user3708270

Reputation: 29

Restrict world access to Amazon S3 URLs

I've configured an S3 bucket with CloudFront and using alternate domain name provided by CludFront (I setup the domain alias images.mydomain.com at my DNS zone file). At my DNS host the CNAME I'm pointing to xyz.cloudfront.net. Both my s3 bucket name and CNAME domain alias are images.mydomain.com.

I want world to access my images at images.mydomain.com/image.jpg and this is working perfectly.

The problem is the same resource is directly accessible by the world via below two URLs too and I don't want this to happen. I want only images.mydomain.com/image.jpg to work for world and not the below two.

images.mydomain.com.s3.amazonaws.com/image.jpg s3.amazonaws.com/images.mydomain.com/image.jpg

How do I achieve this? please help.

Upvotes: 3

Views: 3225

Answers (1)

E.J. Brennan
E.J. Brennan

Reputation: 46859

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

You restrict access to Amazon S3 content by creating an origin access identity, which is a special CloudFront user. You change Amazon S3 permissions to give the origin access identity permission to access your objects, and to remove permissions from everyone else. When your users access your Amazon S3 objects using CloudFront URLs, the CloudFront origin access identity gets the objects on your users' behalf. If your users try to access objects using Amazon S3 URLs, they're denied access. The origin access identity has permission to access objects in your Amazon S3 bucket, but users don't.

Upvotes: 3

Related Questions